cb61c3f9e9179882f3e72a6184be9e63a73c17bcee9ddb941296ab2798e0c7e6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 14:36

Target

a217ffe773a1d201a67ee00c42dd4de5.dll
Size

110KB
MD5

a217ffe773a1d201a67ee00c42dd4de5
SHA1

25ffdfced68e9833cfc7027f84b1afd4510651de
SHA256

cb61c3f9e9179882f3e72a6184be9e63a73c17bcee9ddb941296ab2798e0c7e6
SHA512

469cf7bdb38b3ca093a606665ec7e9916e70b5458d26787a0e391a74c09f3756324abd501a5a3a9bda2d4407a75adfcccc5b4bccd44c4d701d6f3b4e59d1066f
SSDEEP

1536:l+RQvimb1Xz3AaEJw501IwcP4gEhdSrIdWYLpmu14SO:4RQtBDngw501PcAgoWYLwu14SO

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15
PID 2904 wrote to memory of 2736	2904	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a217ffe773a1d201a67ee00c42dd4de5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a217ffe773a1d201a67ee00c42dd4de5.dll,#1
  2⤵
  PID:2736

memory/2736-0-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/2736-1-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download